.dependabot/config.yml is a great feature, thanks!

That said, I faced an unwanted behavior.
Considering two accounts with Dependabot enabled, if an account forks a repo of the other one containing a .dependabot/config.yml file and with outdated dependencies, Dependabot will be auto-activated and will open pull requests on the forked repo.

As a real example, I forked dependabot-core and got four PR in the minute.