They have a pretty good looking responsible disclosure program which I’m assuming he checked first - it’d be surprising for someone who works in the field not to have that same concern:

https://www.cox.com/aboutus/policies/cox-security-responsibl...