What is the first step when sensitive data is accidentally pushed to a public GitHub repository?
Revoke and/or rotate the exposed credentials immediately so they can no longer be used - this is the critical first step before you undertake any history-rewriting or cleanup.