A team stores database passwords in a public container image layer. What should change?

1. Make the file unreadable only through the portal UI
2. Rename the image tag while leaving the secret in the image
3. Put the same password in the image description as a backup
4. Remove exposed secrets, rotate them, and use an appropriate protected runtime secret mechanism