The main PCB has a populated JTAG header, for standard 5-pin JTAG debug and flashing of the firmware.

I did not test out the header to see if the STM32F4 has the 'ROP' (read-out protection) enabled or not.  This is a feature on most of the STM32 family.  You can set 'level's of the ROP protection, protecting the flash contents of the chip from being read from the debug interface.