Would it be worthwhile chaining a usersettings.js file instead ?
All standard stuff in the settings.js file, then it looks for a usersettings.js file - anything found in there overrides what has been set in settings.js ?
Julian and others can then play to their hearts content, you can deliver a standardised settings.js that follows best practices and then anyone can override this is they feel comfortable ?
That is the way other applications manage and secure their config.
For example Mosquitto:
There is a config file /etc/mosquitto/mosquitto.conf (or C:\Program Files\mosquitto\mosquitto.conf) and a directory conf.d with local .conf files to override and extend the defaults.
Mosquitto user credentials are held in a separate file /etc/mosquitto/passwd (Windows - dunno)
Could a similar scheme be adopted for Node-red?
Does the runtime need to edit the settings file? I think not, but creating a new settings file at startup if none exists would have to stop.
Does NR need to handle multiple instances with different settings? Yes.
In theory the settings.js file does just contain defaults anyway as they should all be defaulted in the core (may not be quite true... but) - so the settings.js is really mainly for "documentation" of the options and so should be considered the users one anyway... (also how does conf.d translate cross platform - just more complication).