Every time a secret reaches centralized version control, it must be considered compromised, and you should revoke the secret. At this point, depending on the size of your organization, remediating is often a shared responsibility between Development, Operations and Application Security teams.