It’s likely a Google Console verification file to show you own the domain (e.g. to make changes to search results). It has to be published to the site with a random url that only the owner and Google know, but it’s still a public file. I don’t think it’s an issue if it’s stored in source as Google will query the site and not the source for that file.

If OP is concerned they can also change the verification method: https://support.google.com/webmasters/answer/9008080?hl=en