Under Settings > Environments you should see the deployment source? (Alternatively the overview page should show a recent deployment) That is where it’s deploying the files from.
I don’t recall any FTP or backend Kudu style service on static web apps that you can directly access to delete the file manually so to speak.
Therefore, you’ll like need to remove the sensitive file from the source repository via a pull request. This should trigger a new deployment to the web app and remove the sensitive file from the app.
Let me know how you get on and if this was helpful in resolving the issue then please mark as accepted