Marked as helpful by the asker
Deleting in a new commit does nothing; the keys are in history. Two steps, today: rotate every key in that file (Supabase, Resend, Stripe), then add .env* to .gitignore and git rm --cached .env.local. Rewriting history is optional once the keys are dead. And never say 'commit everything' again; say 'commit the files you changed'.