[bagels]

topic_id is public information, and predictable. It's neither secret, nor random.

[rawling]

This is a weird use case (deliberately making the hash public) and the usual concept of a salt feels weird here. Any kind of server-side secret would have effectively stopped this attack, even if it was the same in every hash.