G306 can be easily bypassed by os.Create

[seiyab]

os.Create creates file with permission 0666.
https://pkg.go.dev/os#Create

os.Create is usually preffered to create & truncate a file so it can accidentally bypass G306 even if developers want to enforce stricter permissions.

I'm not sure what can be a reasonable behavior. Reporting os.Create if allowed permission is stricter than 0666 can be an instant one.

[ccojocar]

Thanks for bringing this up. I think adding a new rule for this, it would be appropriate.