Similar to what's described in #2, the project resource contains a URL (repositoryUrl)inside the actual payload that should be a HAL link instead.
I can see that repository would create ambiguity with the repositories resources we expose ourselves. Maybe source-repository could be used instead?