Secret exposed in history

At 09:10 your secret-scanning tool fires on the public acme/docs repo: a Stripe restricted API key. The committing engineer is already on it, they git rm'd the file and force-pushed 8 minutes ago, and the file is gone from the tip. They mark the alert resolved and tell you "handled, the secret's deleted." The repo has been public for 14 months. Your billing dashboard shows nothing unusual yet. Is this actually contained? Walk through how you triage the real exposure window, decide whether to rotate, and what you check before closing this out.