In my application, I am generating a big random number and publishing a SHA256 hash of it. After the hash it published (but not the secret), anyone can submit any number, and the system will calculate and present them a SHA256 hash of the number derived by concatenating their number at the end of the secret number from my system (SHA256(A+B)). The result of that operation should not be guessable without the secret number.
I am wondering if there are any security concerns with this approach that I should be weary about, such as if the random number is of certain length, would that make the result guessable? Or is this approach cryptographically safe?