This is getting more common. I've seen CVEs posted to several opensource projects that included made-up APIs.