To which repo should referenceapplication fixes be submitted?

I have just taken ownership of issue RA-452 in JIRA and am trying to get my development environment running. I noticed that there are two referenceapplication projects on the openmrs github:

1.) https://github.com/openmrs/openmrs-distro-referenceapplication 2.) https://github.com/openmrs/openmrs-module-referenceapplication

To which project should I submit RA-* bugfixes?

With that ticket, you may make changes to a number of modules like coreapps, etc. My recommendation is that, start by reproducing XSS attacks, then point us to the user interface url, and we direct you to the appropriate module. The general pattern for the module is usually the name after the openmrs context name. For instance if you will look at the url of this page: http://uat02.openmrs.org:8080/openmrs/allergyui/allergy.page, you notice that the module name is allergyui.