An administrator's API signing key is exposed in a repository. What should happen first?

1. Rename the administrator's group and keep the key active.
2. Increase the user's resource quota.
3. Assume removing the latest commit makes all copied keys disappear.
4. Contain the credential by revoking or replacing it and investigate relevant use.