Afaik (I'm no security expert), as soon as you pushed them to a public repo you should change them all regardless of force pushing, because there's no way to take it back. Folks do trawl github for passwords and secrets.