Removing a credential from the latest file is different from invalidating it.
When a credential is committed to Git, removing it from the current file does not remove the earlier commit. Copies may also exist in clones, logs, or build output.
Treat the credential as exposed
If a real secret has been shared, use the provider’s controls to revoke or rotate it. Update the application to use the replacement through an appropriate secret store. Deleting the old text alone does not invalidate the credential.
Check how it got there
Review the path that exposed it: a committed configuration file, a build step, or a browser bundle. Fix that path so a replacement does not follow it. Repository history cleanup may also be appropriate, but it does not replace revocation.
A testing tool should report redacted evidence and the location of a suspected secret. It should not attempt to prove the secret works by using it against the provider.