anchor.diff:            in the National Vulnerability Database) or when the project has been informed and the
             information has been released to the public (possibly by the project). A vulnerability is medium
             to high severity if its CVSS 2.0 base score is 4 or higher.
  -          <strong>[vulnerabilities-fixed-60-days]</strong></span>
  +          <sup>[vulnerabilities-fixed-60-days]</sup></span>
       <%= f.text_field :vulnerabilities_fixed_60_days_justification, class:"form-control", hide_label: true, placeholder:'Please Explain' %>
       </div>
       </div>
  
positive.code:      <div class='col-md-9 criteria-desc'>
       <span>It is SUGGESTED that the tool include rules or approaches to look for
             common vulnerabilities in the analyzed language or environment.
             <strong>[static-analysis-common-vulnerabilities]</strong></span>
       <%= f.text_field :static_analysis_common_vulnerabilities_justification, class:"form-control", hide_label: true, placeholder:'Please Explain' %>
       </div>
       </div>
  
negative.code:       <span>The project MUST provide an initial reply to a security vulnerability report
              sent to the project, on average, less than 7 days within the last 6 months.
              (If a project is being spammed on its vulnerability report channel,
              it is okay to only count non-spam messages.) <sup>[vulnerability-report-response]</sup></span>
        <%= f.text_field :vulnerability_report_response_justification, class:"form-control", hide_label: true, placeholder:'Please Explain' %>
        </div>
        </div>
  