Pick which service the exposed key was for and get the exact steps. This is the same guidance unbreachable's own scanner gives when it finds one of these keys live in a scanned app.
sk_live_…
Stripe secret key
Remove this key from client-side code immediately, rotate it in the Stripe dashboard, and only ever call Stripe's secret API from a server route using an environment variable.
Rule of thumb: rotate first, clean up code second. A key that was ever served in a page or script a browser fetched has to be treated as compromised regardless of whether you've since removed it from the current build.