The protections
Six checks, read from the system: System Integrity Protection, Gatekeeper, FileVault, the application firewall, XProtect and whether security responses install on their own. Each says what it means in a sentence and offers the System Settings pane that changes it.
What starts by itself
Login items, background agents and system daemons, merged from macOS’s own task list and the launch property lists on disk, each judged by who signed its program and where that program lives. Leftovers pointing at programs that are gone are flagged, and can be removed if they are yours.
Permissions
Which apps hold full disk access, screen recording, input monitoring, accessibility, camera, microphone and automation. Reading these lists needs Full Disk Access; without it DiskDuo says so rather than showing an empty list.
Browser extensions
Extensions across Chrome, Brave, Edge, Arc, Vivaldi, Opera, Chromium, Firefox and Safari, with what each can reach. Anything that can read and change every site you visit is marked, and so is anything installed from outside a web store.
What it does not do
It changes nothing. Every fix is a link to the System Settings pane where you decide, or a Move to Trash that goes through the same safety check as any other removal.