Anything pushed is to be considered leaked. You might as well leave the commit in and invalidate the secret.