Dev.to Tag Hacking

#devto #watercooler #security #writing

I was digging around some of my old blogs recently and spotted something interesting, well not interesting, but unexplained.

I blog about the Power Platform, a lot, and one of the things I don't blog about is crypto, so I was surprised to see that a few on my blogs had these tags:

#crypto
#cryptocurrency
#bitcoin
#offers
#web3

Yep it looks like someone hacked my tags, most likely in conjunction with spam comments to push something dodgy.

I wanted a quick way to check all of my blogs and fix any, and luckily there is a API for that.

As Dev.to is built on Forem it has a robust and open api (No known rate limits and auth only for personal permissions like creating a blog). The docs are great as well, https://developers.forem.com/api/, so it's easy to use.

I used the https://dev.to/api/articles?username= endpoint, with an increased page size using ?per_page=1000

https://dev.to/api/articles?username=wyatt&per_page=1000

This returned the following info per blog:

[
    {
        "type_of": "article",
        "id": 2997601,
        "title": "Vibe Coding a Power App the Pro way with Code Apps",
        "description": "In a world of new AI tools and rebranding its hard to keep track of everything Microsoft has...",
        "readable_publish_date": "Nov 17",
        "slug": "vibe-coding-a-power-app-the-pro-way-with-code-apps-56dk",
        "path": "/wyattdave/vibe-coding-a-power-app-the-pro-way-with-code-apps-56dk",
        "url": "https://dev.to/wyattdave/vibe-coding-a-power-app-the-pro-way-with-code-apps-56dk",
        "comments_count": 0,
        "public_reactions_count": 20,
        "collection_id": 19972,
        "published_timestamp": "2025-11-17T06:56:28Z",
        "language": "en",
        "subforem_id": 1,
        "positive_reactions_count": 20,
        "cover_image": "https://media2.dev.to/dynamic/image/width=1000,height=420,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fgris6a1itt7aydpnzsl3.png",
        "social_image": "https://media2.dev.to/dynamic/image/width=1000,height=500,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fgris6a1itt7aydpnzsl3.png",
        "canonical_url": "https://dev.to/wyattdave/vibe-coding-a-power-app-the-pro-way-with-code-apps-56dk",
        "created_at": "2025-11-06T10:59:19Z",
        "edited_at": "2025-11-17T06:58:56Z",
        "crossposted_at": null,
        "published_at": "2025-11-17T06:56:28Z",
        "last_comment_at": "2025-11-17T06:56:28Z",
        "reading_time_minutes": 7,
        "tag_list": [
            "powerapps",
            "powerplatform",
            "vibecoding",
            "lowcode"
        ],
        "tags": "powerapps, powerplatform, vibecoding, lowcode",
        "user": {
            "name": "david wyatt",
            "username": "wyattdave",
            "twitter_username": "wyattDaveDev",
            "github_username": "wyattdave",
            "user_id": 653003,
            "website_url": "https://powerdevbox.com",
            "profile_image": "https://media2.dev.to/dynamic/image/width=640,height=640,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F653003%2Ff6da9df7-019e-4189-ab7f-c5c527fe1db6.png",
            "profile_image_90": "https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F653003%2Ff6da9df7-019e-4189-ab7f-c5c527fe1db6.png"
        }
    }
]

So it was relatively easy to throw together a quick site that listed all of my tags from the tag key in the response, and create quick links to them so I can fix them.

The site shows counts of all tags with quick links to a table with the blogs using that tag.

I also chucked in some extra fluff, like a csv download and a couple of charts provided by my favourite chart library chart.js

So if you want a quick way to check for any hacked tags or just to see what you blog about the most (and maybe spot a typo or 2 🤦‍♂️) you can try the site here: https://powerdevbox.com/subs/devto

You can also throw on a author parameter for quick loading: https://powerdevbox.com/subs/devto?author=wyattdave

I've also raised the issue with dev.to support, but the constant battle against spammers is no easy task.