Once you put something on the internet, you should assume it still exists out there somewhere even after deleting it. Even before copilot, all credentials that end up in a repo needed to be changed. I'm not sure what's supposed to be different now.