anchor.diff:    to send the information in a way that is kept private (e.g., a private defect
     report submitted on the web using TLS or an email encrypted using PGP).
     If private vulnerability reports are not supported this criterion is automatically met.
  -  [vulnerability-report-private]
  +  <sup>[vulnerability-report-private]</sup>
     <!-- vulnerability_report_private_justification -->
   </p>
   
  
positive.code:   in the National Vulnerability Database) or when the project has been informed
    and the information has been released to the public (possibly by the project).
    A vulnerability is medium to high severity if its CVSS 2.0 base score is 4 or higher.
    [vulnerabilities-fixed-60-days]
    <!-- vulnerabilities_fixed_60_days_justification -->
  </p>
  
  <p>
    <strong><%= @project.vulnerabilities_critical_fixed_status %>:</strong>
    Projects SHOULD fix all critical vulnerabilities rapidly after they are reported.
    [vulnerabilities-critical-fixed]
    <!-- vulnerabilities_critical_fixed_justification -->
  </p>
  
  
negative.code:   detect memory safety problems MUST be used during at least one dynamic tool use,
    e.g., Address Sanitizer (ASAN) or valgrind. If the software is not application-level,
    or is not in a memory-unsafe language, then this criterion is automatically met.
    <sup>[dynamic-analysis-unsafe]</sup>
    <!-- dynamic_analysis_unsafe_justification -->
  </p>
  
  <p>
    <strong><%= @project.dynamic_analysis_enable_assertions_status %>:</strong>
    It is SUGGESTED that the software include many run-time assertions that are checked during dynamic analysis.
    <sup>[dynamic-analysis-enable-assertions]</sup>
    <!-- dynamic_analysis_enable_assertions_justification -->
  </p>
  
  