Northwind Traders

Every permission level on each site, with SharePoint groups opened up into their members. Permissions on single files and folders are in File and folder permissions.

Each site's SharePoint groups: its owners, members and visitors groups and any others, what each grants on the site and who is in it. A guest in an owners group has full control of the site.

Lists and libraries that stopped inheriting their site's permissions, so the site's groups don't say who can open them. Each is worth a look: the reason is often a one-off that was never undone.

Subsites that don't inherit their parent site's permissions.

Everyone who can get into at least one site, through any group or directly, with guests and outside accounts first. Microsoft 365 and security groups are opened up where the Groups collection has their members.