Order of hashing concatenation A = hash("blue" + X);
B = hash("pink" + X);


If A and the literals are known and X is unknown, are there attacks on B aside from the attacks on directly on hash()?  In other words, is B safe?

Would it be better to reverse the concatenation?

A = Hash(X + "blue");
B = Hash(X + "pink");


If it matters, I am using hash=sha256.
It looks like you want a message authentication code (MAC).

A MAC is a computable function $M$ of two inputs $k$ and $x$ (usually with variable-sized $x$ and fixed-sized $k$ and output) such that:


Given a lot of pairs $(x_i, m_i)$ with $m_i = M(k, x_i)$ (and not given $k$), it is hard to find $(m, x)$ with $m = M(k, x)$ and $x$ is not one of the $x_i$s).


You actually only need a slightly weaker condition:


Given a lot of pairs $(x_i, m_i)$ with $m_i = M(k, x_i)$ and an $x$ which is not one of the $x_i$s (and not given $k$), and it is hard to find $m = M(k, x)$.


While a random oracle with simple concatenation of the inputs (in either order) would do fine as a MAC, real-life hash functions are not random oracles.
Thus we usually use specially-made MAC functions for this goal - there are ones based on hash functions (specifically HMAC which can be instantiated with every hash function), and others based on block ciphers.

It might be that SHA-256 is safe anyways (maybe depending on the length of your strings), but this is not what SHA-256 was made for.

Simply use HMAC-SHA-256 instead (with your $X$ in the key position).