Both https://github.com/wikimedia/apps-android-wikipedia and https://github.com/wikimedia/wikipedia-ios lack a security policy wrt how and where to reports security bugs.

It doesn't need to be comprehensive, but at bare minimum something like https://github.com/wikimedia/mediawiki/blob/master/SECURITY, or else a more specific way to report the bugs (such as the security form on Phabricator).