How do I stop committing secrets like API keys to Git, and remove one I already pushed?

Personal project on GitHub (public repo). A .env file with a Stripe secret key and a database password was committed and pushed three commits ago. The repo has one other collaborator.

Secrets should never appear in the repository history, and the exposed keys should be made useless to anyone who saw them.

The .env file is visible in the GitHub history. Adding it to .gitignore now hides it from new commits, but the old commits still expose the keys.