If your widget secret key (used for HMAC user identification — see Identify logged-in users with HMAC) is ever exposed, regenerate it from the widget settings in the admin.
Rotating it invalidates the old key immediately, so update your backend's signing code with the new one at the same time you rotate — otherwise identification will start failing until you do.