How to handle secrets leak in GitHub repo?

Today I learned a hard GitHub lesson.
A guy found his personal password committed to a repo. He force-pushed (git push --force) and wiped the history clean. Password still got extracted.
All someone needed was an old PR. Follow the commit chain and the secret was right there.
Force-push only removes the street signs. It doesn’t blow up the road.
PRs, forks, caches, and full SHAs can all still point to the exact commit.
Once a secret hits GitHub, the first move is always the same: revoke it and rotate immediately.