Keila manages mailing lists, contacts, campaigns, forms, senders, and API keys. A count-only ZoomEye query found 1 application match and 190 title matches on 2026-11-04. The title count is small enough to audit, while the single app match shows that the fingerprint identified at least one asset.
Query scope
The probes were app="Keila" and title="Keila" with sub_type=all, page 1, and pagesize 1 at 07:49 Asia/Shanghai. The application query returned 1 and the title query returned 190. These are ZoomEye matches in the selected assignment, not a declaration that all matching pages are live newsletter servers.
Keila's API documentation says that API calls use Bearer authentication with a private API key. The key is displayed once when it is created and cannot be retrieved again. That design supports accountability, but only if the organization records the key owner and stores the secret in a controlled place. A key copied into a campaign template or a client-side script defeats the model.
Separate contacts from content
An email campaign contains message content and a recipient list. The contact data is often more sensitive than the message. Review who can import contacts, create segments, export subscribers, and view delivery results. A campaign editor should not automatically receive contact-export permission. Public signup forms need spam controls, double opt-in where appropriate, and limits on how much user-provided data is accepted.
The API key should not be shared with a browser application. Use a server-side integration that can keep the key private. Store it in a secret manager, rotate it after suspected exposure, and revoke stale keys when an integration is retired. Log API key creation and deletion without logging the key itself.
Harden the self-hosted deployment
Check the public base URL, TLS certificate, and proxy configuration. Confirm that the application does not expose its database or background worker management interface. Review the mail sender configuration and separate the sending credential from the administrative key. Verify that an unauthenticated request to a contacts or campaigns endpoint is rejected.
Back up the database and the sending configuration. Encrypt the backup and test a restore in a separate environment. A newsletter platform that loses its contact suppression list can send mail to people who opted out, which is both a privacy and deliverability incident.
Use title matches to find owners
For each of the 190 title matches, record the hostname, certificate organization, redirect destination, and public page type. Compare the hosts with known marketing domains. If an owned host is found, ask whether the instance is intentionally public and whether forms or API routes are enabled. If the host is not owned, keep the evidence at the level of a public page.
The measured result is a navigation aid. Keila's security value is concentrated in its contact data, API keys, and sending authority. The count helps identify the population; an authenticated configuration review decides whether the boundary is sound.