That's exactly the process - there are full docs at the link below, and we're always keen to hear from potential partners.

Please also note that we only automatically send details from _public_ repos to our secret scanning partners.

https://developer.github.com/partnerships/secret-scanning/