More/proper quoting:
body=$(printf '{"title":"%s","body":"%s","head":"clamour:%s","base":"%s"}' "$TITLE" "$DESCRIPTION" "$TARGET" "$SOURCE")
curl -H "$auth" -d "$body" "https://api.github.com/repos/clamour/$PROJECT/pulls"
All user-supplied variables must be quoted (unless you know exactly why you want to leave then unquoted).
Enclosing a variable name in ${braces} is not the same as "$quoting".
I find using printf tends to be more clear than mixing double and single quotes with variable interpolation.
Get out of the habit of using ALLCAPS variable names: one day you'll use PATH=... and then wonder why your script is broken