anchor.diff:    <strong><%= @project.static_analysis_fixed_status %>:</strong>
     All confirmed medium and high severity exploitable vulnerabilities discovered
     with static code analysis MUST be fixed. A vulnerability is medium to high
  -  severity if its CVSS 2.0 is 4 or higher. [static-analysis-fixed]
  +  severity if its CVSS 2.0 is 4 or higher. <sup>[static-analysis-fixed]</sup>
     <!-- static_analysis_fixed_justification -->
   </p>
   
   <p>
     <strong><%= @project.static_analysis_often_status %>:</strong>
     It is SUGGESTED that static source code analysis occur on every commit or at least daily.
  -  [static-analysis-often]
  +  <sup>[static-analysis-often]</sup>
     <!-- static_analysis_often_justification -->
   </p>
   
  
positive.code:   <strong><%= @project.repo_url_status %>:</strong>
    The project MUST have a version-controlled source repository that is publicly
    readable and has a URL (the URL MAY be the same as the project URL).
    [repo-url]
    <!-- repo_url_justification -->
  </p>
  
  <p>
    <strong><%= @project.repo_track_status %>:</strong>
    The source repository MUST track what changes were made, who made the changes,
    and when the changes were made. [repo-track]
    <!-- repo_track_justification -->
  </p>
  
  <p>
    <strong><%= @project.repo_interim_status %>:</strong>
    The source repository MUST include interim versions for review between releases;
    it MUST NOT include only final releases. [repo-interim]
    <!-- repo_interim_justification -->
  </p>
  
  
negative.code:   It is SUGGESTED that common distributed version control software is used
    (e.g., git). Git is not specifically required and projects can use centralized
    version control software (such as subversion) with justification.
    <sup>[repo-distributed]</sup>
    <!-- repo_distributed_justification -->
  </p>
  
  