A public image repository contains a credential accidentally baked into an old layer. Which response is appropriate?

1. Mark the README confidential
2. Add a later image layer deleting the file only
3. Revoke the credential and remove the exposed artifact appropriately
4. Rename the repository without rotating the credential