You leaked an API key on GitHub. Here's what to do in the next 10 minutes

1. Revoke or rotate the key first. Deleting the commit isn't enough; bots scan pushes within seconds.
2. Check the provider's logs for usage since the push.
3. Remove it from history (git filter-repo) and force-push, then ask collaborators to re-clone.
4. Add secret scanning (GitHub push protection, gitleaks) so it can't happen again.

Tip: SkillPulseLMS blocks posts that look like keys for the same reason.