You'd want to have the secret last in the hash, otherwise you're open to hash extension attacks in some rare cases.