There was a brief report of metadata being stored in the plain: https://myers.io/2015/10/22/1password-leaks-your-data/

There's a rebuttal from AgileBits: https://blog.agilebits.com/2015/10/19/when-a-leak-isnt-a-lea...

Yah, I guess I should't have said that I've never heard a bad word about it, because I did follow that storyline closely. Pretty much, just don't use the old .agilebits keychain and instead use .opvault