Manual Checklist vs Static Analysis: Different Tools, Different Bugs
Static analysis tools — ESLint, TypeScript, Snyk, Semgrep — sit quietly in your CI pipeline and yell when something matches a rule. A manual checklist sits in your head (or on a web page) and relies on you to look at every item. At first glance, static analysis sounds strictly better: it never forgets, it runs automatically, it's consistent. So why does a manual checklist still earn its place in a vibe-coding workflow? Because the bugs each tool catches overlap less than you'd think, and the places each one fails are places the other reliably covers.
What static analysis catches well
Pattern-based bugs with tight rules. Unused variables, misspelled property names, implicit 'any' in TypeScript, common lint violations, known vulnerable package versions, string concatenation that a Semgrep rule recognizes as SQL. These tools shine on bugs that can be expressed as "if you see pattern X, flag it." They run on every commit, every PR, every push, for free, without you remembering. If a bug can be caught by static analysis, it absolutely should be — human attention is too expensive to burn on that kind.
What a manual checklist catches that static analysis misses
Semantic and contextual bugs that no rule can express compactly. "Is the auth check present on this new route?" — a static rule can't tell if your app's convention is to use middleware, a per-route check, or both. "Does this endpoint leak data about other users?" — there's no pattern, only intent. "Did the AI silently delete the rate limiter we added last week?" — static analysis doesn't know it was supposed to be there. These bugs need a human looking at the diff with a list of questions in hand. That's what a review checklist is for.
The coverage gap
Static analysis has near-perfect recall on what it checks and zero recall on what it doesn't. A manual checklist has lower recall per item (you will get tired, you will skim) but covers a wider surface. Together, they hit a larger total set than either alone. Neither is a replacement for the other; they're targeted at different kinds of mistake.
Where AI coding changes the math
Before AI assistants, a lot of checklist items were moot — you knew you'd added the thing because you remembered typing it. With AI generation, the code appears without you writing it line by line, which means your memory is not a reliable source of truth about what's in the diff. This shifts weight toward the manual checklist, because the AI can silently drop items that static analysis has no rule for. The checklist exists to re-impose human attention on parts of the code you didn't personally construct.
The combined stack
Serious setups in 2026 use both. Static analysis runs in CI and blocks the obvious. A manual checklist (or an AI reviewer running a checklist prompt) runs at diff time and catches the contextual. Neither step takes long. Skipping either leaves a category of bugs unguarded — the question is which one you're willing to pay for in production incidents. Our Vibe Code Fix checklist is designed to pair with your existing lint and type checks, not replace them.