My app is a educational game for elementary schools, involving no money or anything of value, so I am not worried about sophisticated attackers having any interest in this. Still, I would like to follow best practices in case any of this code ever does wind up guarding something attractive.
The security consists of hashing values with a constant pepper to produce a hash. Generally, the values are things like the user id and other state info, and hash is used to preventing tampering (i.e., so you can't change the user id to a different value and access someone else's data).
Therefore, over time, the attacker has access to a large set of state info (the pre-hash) AND the hash, but not the pepper. The hash algorithm is also server-side and unknown (though limited in possibilities).
With this knowledge, can an attacker determine the pepper and hash algorithm and be able to generate a suitable hash for any message, breaking our security?