OG image URL is absolute and publicly accessible

Social platform crawlers (Facebookbot, LinkedInBot, Twitterbot) do not follow browser URL resolution rules. A relative path like /og-image.png in an og:image tag is treated as an unresolvable reference — the crawler makes no attempt to prefix a base URL. Per ogp.me, og:image must be an absolute URL. Similarly, when og:image is constructed from an environment variable like NEXT_PUBLIC_SITE_URL that has no fallback, a missing env var in production results in undefined/og-image.png — a malformed URL that produces no image. Per CWE-706, using incorrect resource identifiers in safety-critical paths leads to silent failures. These failures are invisible in local development because browsers resolve relative paths correctly.

Fix relative og:image paths by prepending an absolute base URL with a fallback:

// WRONG:
images: [{ url: '/og-image.png', width: 1200, height: 630 }]

// RIGHT:
const baseUrl = process.env.NEXT_PUBLIC_SITE_URL ?? 'https://yoursite.com'
images: [{ url: `${baseUrl}/og-image.png`, width: 1200, height: 630 }]

For Next.js App Router routes that use opengraph-image.tsx, the framework generates absolute URLs automatically — no changes needed for those routes. Audit all metadata.openGraph.images entries in src/app/ for relative paths and unguarded env var references.