diff --git a/CMakeLists.txt b/CMakeLists.txt
index 0ec8388d..8ad43c2a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -503,7 +503,8 @@ if(RUN_CLANG_TIDY)
 
     set(CLANG_TIDY_LIB_CHECKS
         ${CLANG_TIDY_COMMON_CHECKS}
-        "cppcoreguidelines-avoid-goto")
+        "cppcoreguidelines-avoid-goto"
+        "cppcoreguidelines-non-private-member-variables-in-classes")
 
     # Skip some checks for tests because they're not worth the noise (e.g. GTest
     # happens to use goto).
diff --git a/src/api/metadata_list.h b/src/api/metadata_list.h
index ae5798bd..494301f2 100644
--- a/src/api/metadata_list.h
+++ b/src/api/metadata_list.h
@@ -81,7 +81,7 @@ public:
   // Eval plugin conditions.
   void EvalAllConditions(ConditionEvaluator& conditionEvaluator);
 
-protected:
+private:
   std::vector<Group> groups_;
   std::vector<std::string> bashTags_;
   std::unordered_map<Filename, PluginMetadata> plugins_;