An exposed external API secret is removed from source control. What must still be done?

1. Revoke or rotate the compromised credential and update authorized consumers
2. Rename the source variable only
3. Keep the secret active because the current file is clean
4. Add a warning comment asking attackers not to use it