Distinction between API misuse and software vulnerability