From 61c4e4189db1f91a3603508e2fd3c6e2854be749 Mon Sep 17 00:00:00 2001
From: bitsandfoxes <reg@bitfox.at>
Date: Wed, 4 Nov 2026 09:52:10 +0100
Subject: [PATCH 1/2] Run the CLI options configuration on a copy of the
 options asset

---
 CHANGELOG.md                                  |  6 +++++
 .../SentryScriptableObject.cs                 | 16 ++++++++---
 .../SentryScriptableObjectTests.cs            | 27 +++++++++++++++++++
 3 files changed, 46 insertions(+), 3 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 252fc315b..d4a31f205 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## Unreleased
+
+### Fixes
+
+- Values set in a `SentryCliOptionsConfiguration`, such as an auth token read from an environment variable, no longer get saved into `SentryCliOptions.asset` by the Sentry window after a build. The configuration now runs on a copy of the options. ([#TBD](https://github.com/getsentry/sentry-unity/pull/TBD))
+
 ## 4.12.0
 
 ### Behavioral Changes
diff --git a/src/Sentry.Unity.Editor/SentryScriptableObject.cs b/src/Sentry.Unity.Editor/SentryScriptableObject.cs
index a79773e3d..8f6938d0d 100644
--- a/src/Sentry.Unity.Editor/SentryScriptableObject.cs
+++ b/src/Sentry.Unity.Editor/SentryScriptableObject.cs
@@ -24,10 +24,20 @@ internal static T CreateOrLoad<T>(string path) where T : ScriptableObject
 
     internal static T? Load<T>(string path) where T : ScriptableObject => AssetDatabase.LoadAssetAtPath<T>(path);
 
-    public static SentryCliOptions? LoadCliOptions()
+    public static SentryCliOptions? LoadCliOptions() => LoadCliOptions(SentryCliOptions.GetConfigPath());
+
+    internal static SentryCliOptions? LoadCliOptions(string path)
     {
-        var cliOptions = Load<SentryCliOptions>(SentryCliOptions.GetConfigPath());
-        cliOptions?.CliOptionsConfiguration?.Configure(cliOptions);
+        var savedCliOptions = Load<SentryCliOptions>(path);
+        if (savedCliOptions == null)
+        {
+            return null;
+        }
+
+        // The configuration runs on a copy. The asset is the instance the Sentry window edits and saves, so values
+        // set in code, such as an auth token read from the environment, would otherwise get written to disk.
+        var cliOptions = Object.Instantiate(savedCliOptions);
+        cliOptions.CliOptionsConfiguration?.Configure(cliOptions);
 
         return cliOptions;
     }
diff --git a/test/Sentry.Unity.Editor.Tests/SentryScriptableObjectTests.cs b/test/Sentry.Unity.Editor.Tests/SentryScriptableObjectTests.cs
index 323438634..6783e3d4b 100644
--- a/test/Sentry.Unity.Editor.Tests/SentryScriptableObjectTests.cs
+++ b/test/Sentry.Unity.Editor.Tests/SentryScriptableObjectTests.cs
@@ -83,4 +83,31 @@ public void Load_SentryCliOptionsExist_LoadsSavedOptionsAsset()
         Assert.NotNull(actualOptions);
         Assert.AreEqual(expectedAuth, actualOptions!.Auth);
     }
+
+    [Test]
+    public void LoadCliOptions_ConfigurationSetsAuth_DoesNotChangeSavedAsset()
+    {
+        var savedOptions = SentryScriptableObject.CreateOrLoad<SentryCliOptions>(_assetPath);
+        savedOptions.CliOptionsConfiguration = ScriptableObject.CreateInstance<AuthFromCodeConfiguration>();
+
+        var cliOptions = SentryScriptableObject.LoadCliOptions(_assetPath);
+
+        Assert.NotNull(cliOptions);
+        Assert.AreEqual(AuthFromCodeConfiguration.Auth, cliOptions!.Auth);
+        Assert.IsNull(savedOptions.Auth);
+        Assert.IsNull(SentryScriptableObject.Load<SentryCliOptions>(_assetPath)!.Auth);
+    }
+
+    [Test]
+    public void LoadCliOptions_OptionsAssetDoesNotExist_ReturnsNull()
+    {
+        Assert.IsNull(SentryScriptableObject.LoadCliOptions(_assetPath));
+    }
+
+    private class AuthFromCodeConfiguration : SentryCliOptionsConfiguration
+    {
+        public const string Auth = "auth_from_code";
+
+        public override void Configure(SentryCliOptions cliOptions) => cliOptions.Auth = Auth;
+    }
 }

From 3cf5b9803ef1d7069ec24428b1160b0463c3c242 Mon Sep 17 00:00:00 2001
From: bitsandfoxes <reg@bitfox.at>
Date: Wed, 4 Nov 2026 10:28:32 +0100
Subject: [PATCH 2/2] Add PR link to CHANGELOG

---
 CHANGELOG.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index d4a31f205..dace824a9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,7 +4,7 @@
 
 ### Fixes
 
-- Values set in a `SentryCliOptionsConfiguration`, such as an auth token read from an environment variable, no longer get saved into `SentryCliOptions.asset` by the Sentry window after a build. The configuration now runs on a copy of the options. ([#TBD](https://github.com/getsentry/sentry-unity/pull/TBD))
+- Values set in a `SentryCliOptionsConfiguration`, such as an auth token read from an environment variable, no longer get saved into `SentryCliOptions.asset` by the Sentry window after a build. The configuration now runs on a copy of the options. ([#2927](https://github.com/getsentry/sentry-unity/pull/2927))
 
 ## 4.12.0