We only ever support the latest version with security updates, due to the way the Apple App Store works.
Onion Browser was conceived by Mike Tigas but is now almost exclusively maintained by Guardian Project.
You may reach us on multiple channels: https://guardianproject.info/contact/
We suggest GPG encrypted mail or encrypted Matrix chats for security-related inquiries.
Expect replies on mail within a workday, and near-time answers via chat.
We're happy for any help to get this thing more secure, and we'll work hard to fix it, but please be aware, that on iOS, there's a lot outside of our control.
Onion Browser is basically browser chrome around the Webkit rendering engine bundled up with Tor and some bridge clients.
If it turns out, you really found a security problem, you'll of course will get full credits.
Regarding disclosure, we'd be very happy, if you would follow responsible disclosure guidelines.
Thank you!