just as a follow-up FYI, on github (and most git servers) rewriting history and force-pushing is not entirely sufficient to actually delete something that you accidentally pushed. commits that have been rewritten out of history can usually still be referenced and viewed directly by their hash. (they may eventually get garbage-collected, but there is no guarantee.)

still a good idea to remove it from commit history if possible, but those secrets should be considered compromised and should be changed.