What would you do first after discovering an exposed production API key in a public repository?

Treat the key as compromised and promptly revoke or rotate it through the service’s supported process, coordinating dependent services to avoid unnecessary disruption. Review access logs for misuse, identify its permissions and exposure window, and contain affected resources. Removing the visible commit is insufficient because copies may already exist. Remove the secret from the working tree and relevant history as appropriate, preserve incident evidence, and notify the responsible owners. Prevent recurrence with secret storage, restricted credentials, scanning, and a documented rotation procedure.