Added opt-in flag to enable non-public members

src/libraries/System.Text.Json/ref/System.Text.Json.cs

@@ -453,6 +453,7 @@ public sealed partial class JsonSerializerOptions
     {
         public JsonSerializerOptions() { }
         public bool AllowTrailingCommas { get { throw null; } set { } }
+        public bool AllowPrivateProperties { get { throw null; } set { } }
         public System.Collections.Generic.IList<System.Text.Json.Serialization.JsonConverter> Converters { get { throw null; } }
         public int DefaultBufferSize { get { throw null; } set { } }
         public System.Text.Json.JsonNamingPolicy? DictionaryKeyPolicy { get { throw null; } set { } }

src/libraries/System.Text.Json/src/System/Text/Json/Serialization/JsonClassInfo.cs

@@ -138,7 +138,10 @@ public JsonClassInfo(Type type, JsonSerializerOptions options)
                     {
                         CreateObject = options.MemberAccessorStrategy.CreateConstructor(type);
 
-                        PropertyInfo[] properties = type.GetProperties(BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic);
+                        BindingFlags bindingFlags = options.AllowPrivateProperties
+                            ? BindingFlags.Instance | BindingFlags.Public | BindingFlags.NonPublic
+                            : BindingFlags.Instance | BindingFlags.Public;
+                        PropertyInfo[] properties = type.GetProperties(bindingFlags);
 
                         Dictionary<string, JsonPropertyInfo> cache = CreatePropertyCache(properties.Length);
 

src/libraries/System.Text.Json/src/System/Text/Json/Serialization/JsonSerializerOptions.cs

@@ -29,6 +29,7 @@ public sealed partial class JsonSerializerOptions
         private int _defaultBufferSize = BufferSizeDefault;
         private int _maxDepth;
         private bool _allowTrailingCommas;
+        private bool _allowPrivateProperties;
         private bool _haveTypesBeenCreated;
         private bool _ignoreNullValues;
         private bool _ignoreReadOnlyProperties;
@@ -66,6 +67,26 @@ public bool AllowTrailingCommas
             }
         }
 
+        /// <summary>
+        /// Determines whether non-public properties should be serialized and deserialized.
+        /// The default value is false.
+        /// </summary>
+        /// <exception cref="InvalidOperationException">
+        /// Thrown if this property is set after serialization or deserialization has occurred.
+        /// </exception>
+        public bool AllowPrivateProperties
+        {
+            get
+            {
+                return _allowPrivateProperties;
+            }
+            set
+            {
+                VerifyMutable();
+                _allowPrivateProperties = value;
+            }
+        }
+
         /// <summary>
         /// The default buffer size in bytes used when creating temporary buffers.
         /// </summary>

src/libraries/System.Text.Json/tests/Serialization/PropertyVisibilityTests.cs

@@ -11,6 +11,30 @@ namespace System.Text.Json.Serialization.Tests
 {
     public static class PropertyVisibilityTests
     {
+        [Fact]
+        public static void Serialize_NonPublicProperty_RequiresOptIn()
+        {
+            var obj = new ClassWithPrivateProperty { PrivateProperty = true };
+            var allowNonPublic = new JsonSerializerOptions { AllowPrivateProperties = true };
+
+            string jsonDefault = JsonSerializer.Serialize(obj);
+            string jsonNonPublic = JsonSerializer.Serialize(obj, allowNonPublic);
+
+            Assert.Equal(@"{}", jsonDefault);
+            Assert.Equal(@"{""PrivateProperty"":true}", jsonNonPublic);
+
+            var objDefault = JsonSerializer.Deserialize<ClassWithPrivateProperty>(jsonDefault);
+            var objNonPublic = JsonSerializer.Deserialize<ClassWithPrivateProperty>(jsonNonPublic, allowNonPublic);
+
+            Assert.False(objDefault.PrivateProperty);
+            Assert.True(objNonPublic.PrivateProperty);
+        }
+
+        public class ClassWithPrivateProperty
+        {
+            internal bool PrivateProperty { get; set; }
+        }
+
         [Fact]
         public static void NoSetter()
         {