A sample Python client stores its credential directly in a public repository. What should the developer do?

1. Remove exposed credentials, rotate them, and use supported secure credential configuration
2. Add a comment asking readers not to use the key
3. Rename the variable without rotating the exposed value
4. Increase the maximum output tokens