I did an interview for Indie Hackers with some detail (https://www.indiehackers.com/businesses/dependabot) but the short answer is cold sales was how I got started, followed by piggybacking off of GitHub's new marketplace.

I can't stress enough how valuable (from a learning perspective) sales was for Dependabot, but only after I started targeting the right people. For Dependabot that was commenting on open-source dependency update PRs (that people had created manually).