Plus it could've been archived by another website or a private scraping tool which looks for exactly these sorts of exposures. Removing it from the git history

Plus it could've been archived by another website or a private scraping tool which looks for exactly these sorts of exposures. Removing it from the git history is almost irrelevant and just stops future people who find it from sniffing around. The crucial part is rotating the credentials and ensuring the credentials aren't used anywhere else. The second step should be reviewing all logs to ensure no unauthorized logins occurred before the credentials were changed (even if the exposure was only exploitable for a few seconds).