A private API key was accidentally pushed to a public repository. What is the first essential response?

1. Make the repository private and assume secrecy is restored
2. Delete the current file and keep using the key
3. Revoke or rotate the exposed credential
4. Rename the variable containing the key