Criticise the process that let it through.

Why was the testing not sufficient? Was it even tested at all? Maybe a developer just "pushed it straight to master"? Why/how can they do that (hypothetically)