You should really be using a pre commit hook to catch secrets. Admittedly it may not have caught this, but manual review is (clearly) not always sufficient.