A private API signing key is exposed in a public repository. What is the appropriate response?

1. Revoke or replace the compromised credential and investigate its use
2. Assume the key is safe because the repository was public for only a short time
3. Rename the user's group and keep using the same key
4. Increase the user's resource quota