A key typed into code travels everywhere the code goes: into git history, into every copy of the repository, into screenshots, and into the next prompt you paste it into. Hard-coded credentials have their own entry in MITRE's weakness list, CWE-798.
Deleting the key in a later commit does not take it out of history. GitHub's own guidance is to treat a committed secret as exposed and revoke or rotate it first, then clean the history if you need to.
Logs are the second leak. A line that prints request headers prints the Authorization header; an error message that includes the token puts it on every screen and log that shows the error. CWE-532 covers sensitive information written to log files.
Keep secrets in environment variables or a secret store, keep the .env file out of git (and read the .gitignore the model wrote: one "!" can un-ignore it), and never give a live key a fallback value in code.