Keys committed to GitHub in GitHub

Rotate the key at the provider first. Then remove it from history if the repo was shared or public. History rewriting (git filter-repo or a similar tool) changes commit hashes and requires everyone to re-clone. Do not rewrite history until you understand that it disrupts open pull requests. Rotation matters more than a pretty history: a rewritten public repo can still have been scraped.

Turn on secret scanning and push protection where GitHub offers them for your repo. For a public repository, GitHub's security features page says secret scanning alerts and push protection are available by default. Private repositories need GitHub Secret Protection, which is a paid product on Team or Enterprise Cloud. Do not assume a private hobby repo is being scanned.

Add a .gitignore entry before the next commit:

.env
.env.*
!.env.example