Pop!_OS supports its Ubuntu-based versions for the standard security maintenance period as specified by Ubuntu: https://ubuntu.com/about/release-cycle
To report a vulnerability, send an email to security@system76.com or use the private vulnerability reporting form here: https://github.com/pop-os/pop/security/advisories/new