Asked about When something goes wrong in git
You pushed an API key to a public repository. What do you do?
An answer that works
Revoke the key and issue a new one first, because it may already have been copied by automated scanners within minutes. Then remove it from the code and, if needed, from history, and add secret scanning to prevent a repeat. Check the provider's logs for misuse.
Then they push further
Why is deleting the commit not enough?
Anyone who cloned or scanned the repository already has it, forks keep it, and caches may too. Only revoking the key removes the risk.
What gets marked up
Revoking first is the whole answer. Candidates who start with rewriting history are marked down.
Reading an answer is not being able to give one. The section that teaches this is When something goes wrong in git, 3 hours of Git & collaboration.
Learn this properlyAlso asked about Git & collaboration