Why the salt is only published after settlement

The salt is 64 random characters mixed into the hashed string, and it is the only part of that string a reader does not have before the match. It is also, quite literally, the paywall.

Without it, the hash is guessable

On any given night there is a short list of fixtures, a handful of markets and prices that move in steps. If the hash covered only those, anyone could hash every plausible combination until one matched — a laptop, an afternoon — and read the paid selection straight out of a number we published for free. Sixty-four random characters make that search impossible: there is nothing to enumerate.

So the gate is settlement, not release. Before that point the API sends nothing in place of the salt, and the field is hidden on the record itself rather than filtered out in the page — a selection withheld in the interface but sitting in the JSON underneath is not withheld at all.

After settlement it costs nothing

Once the match is over the selection has no commercial value left. Publishing the salt then costs us nothing and buys the archive the only thing that matters about it: anyone can recompute the hash and see it matches. That is why the whole scheme is shaped this way round — the hash goes out when it is worth something to withhold the pick, and the salt goes out when it is not.

The consequence, stated plainly

Verification is retrospective. You cannot check today's pick today. What you can check is the entire record behind it, and today's pick joins that record the moment it settles. If that sounds like a limitation, it is one — it is simply the smaller of two: the alternative is a scheme that verifies live and gives the product away.