Drupal.org vs GitHub ReadMe Stats

Drupal.org exposes its community project and node data through a legacy Drupal 7 REST endpoint (`drupal.org/api-d7/node.json`); a live unauthenticated GET returned a 200 JSON body with `Access-Control-Allow-Origin: *`, resolving cors "unknown" to "yes". It's a free community resource run by the nonprofit Drupal Association, with no authentication or paid tier for reading published project data.

GitHub Readme Stats generates SVG stat/language/pin cards for GitHub profile READMEs; its handler explicitly sets `Content-Type: image/svg+xml` and, per its own README, the shared public demo at `github-readme-stats.vercel.app/api` is "best-effort and can be unreliable due to rate limits and traffic spikes" (confirmed today: it returned a `DEPLOYMENT_PAUSED` 503) — the project itself is very much alive (58k+ GitHub stars, commits within the last week) and explicitly recommends self-hosting or a GitHub Actions workflow instead of relying on the shared instance. Neither the Vercel serverless handlers nor Vercel's platform add a CORS header by default, correcting cors from "yes" to "no". Free and open-source, self-hostable.