A real API token was pasted into a model prompt and then removed from the generated fixtu…

A real API token was pasted into a model prompt and then removed from the generated fixture. What is the correct response?

1. Treat it as exposed under the provider retention model, revoke or rotate it, and inspect downstream use
2. No action is needed because the latest fixture no longer contains the token
3. Replace half the token with asterisks in the same prompt
4. Commit the deletion so repository history proves the token is gone