The researcher followed responsible disclosure by alerting the team privately before going public.

Responsible disclosure gives developers time to patch vulnerabilities before attackers can exploit them in the wild.