Treat a credential committed to a repository as potentially exposed. Revoke or rotate it through the provider’s supported process and identify which services used it. Removing it from the current file alone does not make the old credential unusable.

Review access and usage with the responsible owner, restore affected integrations safely, and follow the repository’s guidance for sensitive history. Keep replacement values out of logs, screenshots and future commits. This is a demo learning guide, not an incident report.