A build's tests pass but its secret accidentally appears in logs. What should happen?

1. Copy the same secret into more logs to make searching easier.
2. Approve production because a green build guarantees secrecy.
3. Contain and rotate the exposed credential, restrict log access, and fix the leakage.
4. Rename the log stream while leaving the credential active.