diff --git a/.eslintrc.json b/.eslintrc.json
index 63e9302c16..f410effc86 100644
--- a/.eslintrc.json
+++ b/.eslintrc.json
@@ -86,6 +86,12 @@
     "no-prototype-builtins": "off",
     "prefer-const": "error",
     "@typescript-eslint/ban-types": "off",
+    "@typescript-eslint/explicit-member-accessibility": [
+      "error",
+      {
+        "accessibility": "no-public"
+      }
+    ],
     "@typescript-eslint/explicit-module-boundary-types": "off",
     "@typescript-eslint/no-empty-function": "off",
     "@typescript-eslint/no-explicit-any": "error",
diff --git a/client/electron/process.ts b/client/electron/process.ts
index 4d16079c8f..2ff39998dd 100755
--- a/client/electron/process.ts
+++ b/client/electron/process.ts
@@ -48,7 +48,7 @@ export class ChildProcessHelper {
   /**
    * Whether to enable verbose logging for the process.  Must be called before launch().
    */
-  public isDebugModeEnabled = false;
+  isDebugModeEnabled = false;
 
   private stdOutListener?: ((data?: string | Buffer) => void) | null;
 
diff --git a/client/electron/routing_service.ts b/client/electron/routing_service.ts
index 78968d9b0d..9a882a98e4 100755
--- a/client/electron/routing_service.ts
+++ b/client/electron/routing_service.ts
@@ -215,11 +215,11 @@ export class RoutingDaemon {
     return this.writeReset();
   }
 
-  public get onceDisconnected() {
+  get onceDisconnected() {
     return this.disconnected;
   }
 
-  public set onNetworkChange(newListener: ((status: TunnelStatus) => void) | undefined) {
+  set onNetworkChange(newListener: ((status: TunnelStatus) => void) | undefined) {
     this.networkChangeListener = newListener;
   }
 }
diff --git a/client/src/www/app/electron_main.ts b/client/src/www/app/electron_main.ts
index a63619b5f2..29cbcb5038 100644
--- a/client/src/www/app/electron_main.ts
+++ b/client/src/www/app/electron_main.ts
@@ -75,7 +75,7 @@ class ElectronUpdater extends AbstractUpdater {
 }
 
 class ElectronVpnInstaller implements VpnInstaller {
-  public async installVpn(): Promise<void> {
+  async installVpn(): Promise<void> {
     const err = await window.electron.methodChannel.invoke('install-outline-services');
 
     // catch custom errors (even simple as numbers) does not work for ipcRenderer:
diff --git a/client/src/www/app/electron_outline_tunnel.ts b/client/src/www/app/electron_outline_tunnel.ts
index 6739e51619..2d9a906e4a 100644
--- a/client/src/www/app/electron_outline_tunnel.ts
+++ b/client/src/www/app/electron_outline_tunnel.ts
@@ -20,7 +20,7 @@ export class ElectronOutlineTunnel implements Tunnel {
 
   private running = false;
 
-  constructor(public readonly id: string) {
+  constructor(readonly id: string) {
     // This event is received when the proxy connects. It is mainly used for signaling the UI that
     // the proxy has been automatically connected at startup (if the user was connected at shutdown)
     window.electron.methodChannel.on(`proxy-connected-${this.id}`, () => {
diff --git a/client/src/www/app/fake_tunnel.ts b/client/src/www/app/fake_tunnel.ts
index 691443da86..e2f8b56234 100644
--- a/client/src/www/app/fake_tunnel.ts
+++ b/client/src/www/app/fake_tunnel.ts
@@ -24,7 +24,7 @@ export const FAKE_UNREACHABLE_HOSTNAME = '10.0.0.24';
 export class FakeOutlineTunnel implements Tunnel {
   private running = false;
 
-  constructor(public readonly id: string) {}
+  constructor(readonly id: string) {}
 
   private playBroken(hostname?: string) {
     return hostname === FAKE_BROKEN_HOSTNAME;
diff --git a/client/src/www/app/outline_server_repository/index.ts b/client/src/www/app/outline_server_repository/index.ts
index b33763d60a..d3bb5725e3 100644
--- a/client/src/www/app/outline_server_repository/index.ts
+++ b/client/src/www/app/outline_server_repository/index.ts
@@ -101,8 +101,8 @@ interface OutlineServerJson {
 // Maintains a persisted set of servers and liaises with the core.
 export class OutlineServerRepository implements ServerRepository {
   // Name by which servers are saved to storage.
-  public static readonly SERVERS_STORAGE_KEY_V0 = 'servers';
-  public static readonly SERVERS_STORAGE_KEY = 'servers_v1';
+  static readonly SERVERS_STORAGE_KEY_V0 = 'servers';
+  static readonly SERVERS_STORAGE_KEY = 'servers_v1';
   private serverById!: Map<string, OutlineServer>;
   private lastForgottenServer: OutlineServer | null = null;
 
diff --git a/client/src/www/app/outline_server_repository/server.ts b/client/src/www/app/outline_server_repository/server.ts
index 6d16880f70..a2ee647440 100644
--- a/client/src/www/app/outline_server_repository/server.ts
+++ b/client/src/www/app/outline_server_repository/server.ts
@@ -30,9 +30,9 @@ export class OutlineServer implements Server {
   private sessionConfig?: ShadowsocksSessionConfig;
 
   constructor(
-    public readonly id: string,
-    public readonly accessKey: string,
-    public readonly type: ServerType,
+    readonly id: string,
+    readonly accessKey: string,
+    readonly type: ServerType,
     private _name: string,
     private tunnel: Tunnel,
     private eventQueue: events.EventQueue
diff --git a/client/src/www/app/vpn_installer.ts b/client/src/www/app/vpn_installer.ts
index 5364c65ca3..209dabe818 100644
--- a/client/src/www/app/vpn_installer.ts
+++ b/client/src/www/app/vpn_installer.ts
@@ -26,7 +26,7 @@ export interface VpnInstaller {
  * An VPN installer which does nothing to the OS.
  */
 export class NoOpVpnInstaller implements VpnInstaller {
-  public installVpn(): Promise<void> {
+  installVpn(): Promise<void> {
     return Promise.resolve();
   }
 }
diff --git a/client/src/www/model/errors.ts b/client/src/www/model/errors.ts
index de1b41e2ec..99aa7f41d9 100644
--- a/client/src/www/model/errors.ts
+++ b/client/src/www/model/errors.ts
@@ -17,13 +17,13 @@ import {CustomError} from '@outline/infrastructure/custom_error';
 import {Server} from './server';
 
 export class ServerAlreadyAdded extends CustomError {
-  constructor(public readonly server: Server) {
+  constructor(readonly server: Server) {
     super();
   }
 }
 
 export class ShadowsocksUnsupportedCipher extends CustomError {
-  constructor(public readonly cipher: string) {
+  constructor(readonly cipher: string) {
     super();
   }
 }
@@ -78,7 +78,7 @@ export class ProxyConnectionFailure extends CustomError {
 //
 // TODO: Rename this class, "plugin" is a poor name since the Electron apps do not have plugins.
 export class OutlinePluginError extends CustomError {
-  constructor(public readonly errorCode: ErrorCode) {
+  constructor(readonly errorCode: ErrorCode) {
     super();
   }
 }
diff --git a/client/src/www/model/events.ts b/client/src/www/model/events.ts
index 26f871fa4e..97abbdbdfb 100644
--- a/client/src/www/model/events.ts
+++ b/client/src/www/model/events.ts
@@ -20,31 +20,31 @@ export interface OutlineEvent {}
 export type OutlineEventListener<T extends OutlineEvent> = (event: T) => void;
 
 export class ServerAdded implements OutlineEvent {
-  constructor(public readonly server: Server) {}
+  constructor(readonly server: Server) {}
 }
 
 export class ServerForgotten implements OutlineEvent {
-  constructor(public readonly server: Server) {}
+  constructor(readonly server: Server) {}
 }
 
 export class ServerForgetUndone implements OutlineEvent {
-  constructor(public readonly server: Server) {}
+  constructor(readonly server: Server) {}
 }
 
 export class ServerRenamed implements OutlineEvent {
-  constructor(public readonly server: Server) {}
+  constructor(readonly server: Server) {}
 }
 
 export class ServerConnected implements OutlineEvent {
-  constructor(public readonly server: Server) {}
+  constructor(readonly server: Server) {}
 }
 
 export class ServerDisconnected implements OutlineEvent {
-  constructor(public readonly server: Server) {}
+  constructor(readonly server: Server) {}
 }
 
 export class ServerReconnecting implements OutlineEvent {
-  constructor(public readonly server: Server) {}
+  constructor(readonly server: Server) {}
 }
 
 // Simple publisher-subscriber queue.
diff --git a/infrastructure/path_api.ts b/infrastructure/path_api.ts
index 50aa0105b1..93dc200c98 100644
--- a/infrastructure/path_api.ts
+++ b/infrastructure/path_api.ts
@@ -66,7 +66,7 @@ export class PathApiClient {
    * @param base A valid URL
    * @param fingerprint A SHA-256 hash of the expected leaf certificate, in binary encoding.
    */
-  constructor(public readonly base: string, public readonly fetcher: Fetcher) {}
+  constructor(readonly base: string, public readonly fetcher: Fetcher) {}
 
   /**
    * Makes a request relative to the base URL with a JSON body.
diff --git a/infrastructure/timeout_promise.ts b/infrastructure/timeout_promise.ts
index 7897b7d6b4..fc6dc85106 100644
--- a/infrastructure/timeout_promise.ts
+++ b/infrastructure/timeout_promise.ts
@@ -15,7 +15,7 @@
 import {CustomError} from './custom_error';
 
 export class OperationTimedOut extends CustomError {
-  constructor(public readonly timeoutMs: number, public readonly operationName: string) {
+  constructor(readonly timeoutMs: number, public readonly operationName: string) {
     super();
   }
 }
diff --git a/server_manager/model/digitalocean.ts b/server_manager/model/digitalocean.ts
index 4e88d7f8ac..7b9d50e42f 100644
--- a/server_manager/model/digitalocean.ts
+++ b/server_manager/model/digitalocean.ts
@@ -28,7 +28,7 @@ export class Region implements location.CloudLocation {
     syd: location.SYDNEY,
     tor: location.TORONTO,
   };
-  constructor(public readonly id: string) {}
+  constructor(readonly id: string) {}
 
   get location(): location.GeoLocation {
     return Region.LOCATION_MAP[this.id.substring(0, 3).toLowerCase()];
diff --git a/server_manager/model/gcp.ts b/server_manager/model/gcp.ts
index 2261602903..cadcb7d575 100644
--- a/server_manager/model/gcp.ts
+++ b/server_manager/model/gcp.ts
@@ -49,7 +49,7 @@ export class Zone implements location.CloudLocation {
   };
 
   /** ID is a GCP Zone ID like "us-central1-a". */
-  constructor(public readonly id: string) {}
+  constructor(readonly id: string) {}
 
   /** Returns a region ID like "us-central1". */
   get regionId(): string {
diff --git a/server_manager/model/location.ts b/server_manager/model/location.ts
index 25b6738b41..4ae84d6b69 100644
--- a/server_manager/model/location.ts
+++ b/server_manager/model/location.ts
@@ -29,7 +29,7 @@
  * When the key and value are equal, this indicates that they are redundant.
  */
 export class GeoLocation {
-  constructor(public readonly id: string, public readonly countryCode: string) {}
+  constructor(readonly id: string, public readonly countryCode: string) {}
 
   countryIsRedundant(): boolean {
     return this.countryCode === this.id;