I am deploying my experiment to the lab laptops via Heroku, however I can't think of a way to stop participants from opening a new browser tabs and surfing the internet during the experiment, remote as the possibility may seem. This is especially of concern since our game involves a lot of waiting. 

Any advice, comments, suggestions?

At the BonnEconLab, we use KeyTweak (Windows-based) for disabling or remapping keys on the keyboard. For instance, we remap the [alt] and [ctrl] keys, so that participants cannot use [alt] + [tab] to switch to a different program, and they also cannot use [ctrl] + [t] to open a new browser tab, etc. We also remap [F1], because in some browsers, this opens a help page in a new browser tab or window, which participants could then use as a springboard to access other URLs.

• For details on KeyTweak, see, e.g., https://ictsolved.github.io/remap-key-in-windows/ or https://superuser.com/questions/72812/how-to-remap-special-keys-on-my-keyboard.

Beware that KeyTweak changes the registry, so the remapping will remain effective after rebooting the computers. In other words, any remapping that you set up will also affect other users of the respective laptops.

Alternatively,

• there seems to be an onboard tool for remapping keys (but not keyboard combinations) under Windows (10/11): See https://www.microsoft.com/en-us/windows/learning-center/how-to-remap-your-keyboard and https://learn.microsoft.com/en-us/windows/powertoys/keyboard-manager. Also see https://www.youtube.com/watch?v=SoV4K-00vnU.

This probably, too, will remain effective after rebooting the computers.

For remapping/disabling keys and/or keyboard combinations in a nonpersistent way, I would recommend 

• AutoHotKey, see https://www.autohotkey.com.

One way in which experimenters in Bonn used AutoHotKey was to disable [Enter] so that participants could not accidentally submit oTree forms. (This could also be achieved via JavaScript.)

Importantly, when running browser-based experiments, we start the browser in “kiosk” mode (e.g., create an alias for Chrome that executes "C:\Program Files\Google\Chrome\Application\chrome.exe --kiosk https://your.oTree.URL"). This way, participants do not see any menu, tab bar, or address bar which would allow them to open new browser tabs via mouse clicks and URLs other than the oTree URL.