anchor.diff:      <div class='col-md-9 criteria-desc'>
       <span>A cryptographic hash (e.g., a sha1sum) MUST NOT be retrieved over http and
             used without checking for a cryptographic signature, since these hashes
  -          can be modified in transit. <strong>[delivery-unsigned]</strong></span>
  +          can be modified in transit. <sup>[delivery-unsigned]</sup></span>
       <%= f.text_field :delivery_unsigned_justification, class:"form-control", hide_label: true, placeholder:'Please Explain' %>
       </div>
       </div>
  
positive.code:           an approved license by the Open Source Initiative (OSI)
            a free license as approved by the Free Software Foundation (FSF)
            a free license acceptable to Debian main
            a "good" license according to Fedora. <strong>[oss-license]</strong></span>
         <%= f.text_field :oss_license_justification, class:"form-control", hide_label: true, placeholder:'Please Explain' %>
        </div>
        </div>
  
negative.code:           limited attack surface (the attack surface - the set of the different points where an attacker can try to enter or extract data - should be limited)
            input validation with whitelists (inputs should typically be checked to determine if they are valid before they are accepted;
            this validation should use whitelists (which only accept known-good values),
            not blacklists (which attempt to list known-bad values)) <sup>[know-secure-design]</sup></span>
      <%= f.text_field :know_secure_design_justification, class:"form-control", hide_label: true, placeholder:'Please Explain' %>
      </div>
      </div>
  