diff --git a/datasette/app.py b/datasette/app.py
index b8a5e23d..e3ad5fc7 100644
--- a/datasette/app.py
+++ b/datasette/app.py
@@ -289,7 +289,7 @@ class Datasette:
         pm.hook.prepare_jinja2_environment(env=self.jinja_env)
 
         self._register_renderers()
-        self.permission_checks = collections.deque(maxlen=30)
+        self._permission_checks = collections.deque(maxlen=30)
         self._root_token = os.urandom(32).hex()
 
     def sign(self, value, namespace="default"):
@@ -445,7 +445,7 @@ class Datasette:
         if result is None:
             result = default
             used_default = True
-        self.permission_checks.append(
+        self._permission_checks.append(
             {
                 "when": datetime.datetime.utcnow().isoformat(),
                 "actor": actor,
diff --git a/datasette/views/special.py b/datasette/views/special.py
index b75355fb..811ed4cb 100644
--- a/datasette/views/special.py
+++ b/datasette/views/special.py
@@ -92,5 +92,5 @@ class PermissionsDebugView(BaseView):
         return await self.render(
             ["permissions_debug.html"],
             request,
-            {"permission_checks": reversed(self.ds.permission_checks)},
+            {"permission_checks": reversed(self.ds._permission_checks)},
         )