Looks nice! I agree that exposing directory listings might expose some nasty vulnerabilities, but if you take good care of which paths you expose I think it can be circumvented.
A note on the module name, I’m not sure putting it under Plug.Static namespace is a good idea… I named my package Phoenix.Token.Plug back then and Chris asked me to change it, because I think the convention in Elixir is to not stomp on each other’s namespaces 
I don’t know if that applies to yours, but in case it does, probably you can use PlugStatic.Ls or PlugStaticLs?
