Clarification about what I think is legal and not legal.

Crowdfunding a product (where you give out coins in the product as the reward) appears to be not an investment security as long as you as the lead developer (or his controlling group) does not continue to exclusively manage the coin as a controlling entity. In other words, you are selling only your programming services and are not managing an investment. Thus you must complete your development work and debugging before you accept the funds from the crowdfunding. Any ongoing work would come from anyone who wants to submit patches, and the decentralized nodes in the system can decide whether to upgrade or not (thus no hard forks can work). For features requiring a hard fork, then create a new coin.

So I would still be able to submit patches as well as others could for as long as I don't try to control some master copy of the open source and commit access (thus not acting as a controlling entity for the product), i.e. as Linus explains about decentralized version control Git, everyone can have their own local copy of the changesets they have merged.