You removed the API key and pushed. It is still in your history, still readable by anyone who cloned the repo, and still valid until you rotate it. What to do in what order.
You noticed the API key sitting in a file, moved it into an environment variable, committed, and pushed. The current version of your code is clean. The key is still there.
Git does not remove history when you change a file. It records the change. The commit that first contained that key still contains it, and anyone who can read your repository — which, if it has ever been public or ever been cloned, is more people than you think — can read that commit.
The one thing that actually fixes it
Rotate the key. Go to the service it belongs to, generate a new one, and invalidate the old one. That takes effect immediately and it does not matter what your git history says afterwards, because the string in that old commit no longer opens anything.
Do that first. Every other step is housekeeping.
Then, in order
Move the new key into an environment variable, and add the file it was in to `.gitignore` so it cannot come back the same way.
Check whether the key was used anywhere it should not have been — a serverless function is fine, browser code is not. A key that is safe in one place and exposed in another is a separate problem from the one in your history.
Only then consider rewriting history. Tools exist for it, they change every commit hash after the one you edited, and they break every clone and open pull request. On a solo project that may be worth it. On a shared one it is usually more disruption than it buys you, given that you have already rotated the key.
Why we report it even after you rotate
We cannot tell from your repository whether a key is still valid — checking would mean sending it to the service it belongs to, which we will not do. So a key in your history is reported as found, with its location and its age, and the fix step tells you to rotate rather than to delete.
If you have rotated it, dismiss the finding with that as the reason. The dismissal persists across future scans, so you are not told about it every week, and the record of your decision stays attached to it.