Yes he certainly is; he also reported it afterwards via HackerOne to get that $5k bounty. Two birds one stone.