that's already a concern. what if someone just cloned your repo? there's also plenty of people that mirror public repos to their personal forgejo server. forgejo makes it very easy.

the only solution to mitigate such a mistake is to
1) invalidate the token
2) remove the commit

In that order.