Twitter  says a security bug may have exposed the private direct messages of its Android  app users, but said that there was no evidence that the vulnerability was ever exploited.