When I was signing in to Google as a new Orion user, multiple "save password" requests happen, and I pressed OK on all of them.
Afterwards, there is a username,password item where my google account password was stored as plaintext in the "username" field and the password was empty. The website listed was accounts.google.com. There is still the actual item where the email/password was properly stored.
I manually went into the keychain and deleted it.

The extra, non-secure username/password shouldn't be there.
Version 0.99.137-beta (WebKit 623.1.8.0.0)
Sequoia (15)